# BRD-225 — Authentication+ must now be ordered explicitly

> Under Authentication+ 2.0 the vet must be ordered explicitly after the identity check; it no longer runs automatically.

- **Rule ID:** BRD-225
- **Layer:** Brand (`BRAND`)
- **Checks:** `the Authentication+ vet order`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Wait on an external system or a required interval
- **Required by:** TCR
- **Applies:** Applies when the brand is a public company.
- **Canonical URL:** https://ekas.io/rules/10dlc/brand/brd-225/

## Why this rule exists

It used to be automatic, so every runbook, integration and mental model built before the change assumes it will happen on its own. It does not: the brand verifies, nobody orders the vet, and the public-company brand sits without the Authentication+ status that gates its campaigns — with no error anywhere, because nothing failed.

## How to fix it

After the identity check completes, place the Authentication+ order explicitly and watch for the 2FA mail. Add the order as a step in your onboarding runbook — its absence produces no error, so nothing will remind you.

## Check this yourself

**Has the Authentication+ vet been ordered explicitly, as a step in your runbook, after the identity check completed?**

1. Open the brand and confirm an Authentication+ order exists. It used to run automatically and no longer does.
2. Add the order to the onboarding runbook — its absence produces no error, so nothing will remind you.
3. Then watch the business contact mailbox for the 2FA mail.

*What wrong looks like:* The brand verifies and looks healthy. No vet was ordered, every campaign is refused, and nothing anywhere reports a failure — because nothing failed.

## Notes

The order is an action at the registry rather than a field on the registration. What the user has to do is remember it: a public brand that verified but was never Authentication+ vetted looks healthy and cannot register campaigns.